Fix windows firewall for system stack

stack.go

@@ -28,6 +28,7 @@ type StackOptions struct {
 	Logger                         logger.Logger
 	ForwarderBindInterface         bool
 	InterfaceFinder                control.InterfaceFinder
+	ExperimentalFixWindowsFirewall bool
 }
 
 func NewStack(

system.go

@@ -42,6 +42,7 @@ type System struct {
 	routeMapping       *RouteMapping
 	bindInterface      bool
 	interfaceFinder    control.InterfaceFinder
+	fixWindowsFirewall bool
 }
 
 type Session struct {
@@ -65,6 +66,7 @@ func NewSystem(options StackOptions) (Stack, error) {
 		inet6Prefixes:      options.Inet6Address,
 		bindInterface:      options.ForwarderBindInterface,
 		interfaceFinder:    options.InterfaceFinder,
+		fixWindowsFirewall: options.ExperimentalFixWindowsFirewall,
 	}
 	if stack.router != nil {
 		stack.routeMapping = NewRouteMapping(options.UDPTimeout)
@@ -97,6 +99,12 @@ func (s *System) Close() error {
 }
 
 func (s *System) Start() error {
+	if s.fixWindowsFirewall {
+		err := fixWindowsFirewall()
+		if err != nil {
+			return E.Cause(err, "fix windows firewall for system stack")
+		}
+	}
 	var listener net.ListenConfig
 	if s.bindInterface {
 		listener.Control = control.Append(listener.Control, func(network, address string, conn syscall.RawConn) error {

system_nonwindows.go

@@ -0,0 +1,7 @@
+//go:build !windows
+
+package tun
+
+func fixWindowsFirewall() error {
+	return nil
+}

system_windows.go

@@ -0,0 +1,47 @@
+package tun
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	E "github.com/sagernet/sing/common/exceptions"
+	F "github.com/sagernet/sing/common/format"
+	"github.com/sagernet/sing/common/shell"
+)
+
+func fixWindowsFirewall() error {
+	const shellStringSplit = "\""
+	isPWSH := true
+	powershell, err := exec.LookPath("pwsh.exe")
+	if err != nil {
+		powershell, err = exec.LookPath("powershell.exe")
+		isPWSH = false
+	}
+	if err != nil {
+		return nil
+	}
+	ruleName := "sing-tun rule for " + os.Args[0]
+	commandPrefix := []string{"-NoProfile", "-NonInteractive"}
+	if isPWSH {
+		commandPrefix = append(commandPrefix, "-Command")
+	}
+	err = shell.Exec(powershell, append(commandPrefix,
+		F.ToString("Get-NetFirewallRule -Name ", shellStringSplit, ruleName, shellStringSplit))...).Run()
+	if err == nil {
+		return nil
+	}
+	fileName := filepath.Base(os.Args[0])
+	output, err := shell.Exec(powershell, append(commandPrefix,
+		F.ToString("New-NetFirewallRule",
+			" -Name ", shellStringSplit, ruleName, shellStringSplit,
+			" -DisplayName ", shellStringSplit, "sing-tun (", fileName, ")", shellStringSplit,
+			" -Program ", shellStringSplit, os.Args[0], shellStringSplit,
+			" -Direction Inbound",
+			" -Protocol TCP",
+			" -Action Allow"))...).Read()
+	if err != nil {
+		return E.Extend(err, output)
+	}
+	return nil
+}